Terminating instances lose IAM role

From time to time, we see reports of Instances without an IAM role. The instance is usually either missing or terminated when we go look at it. We think that the role gets detached from the instance before it is completely terminated (but during termination) and the scan picks it up if the scan runs at just the right time.

It usually goes away on the subsequent scan.

We think that instances in the termination process should be ignored by the Instance IAM Role plugin.

Start by locating the Instance IAM Role plugin and reading how it evaluates instances during termination. Reproduce or inspect a scan involving an instance in the termination process, then verify that such instances are ignored while active instances without an IAM role are still reported.

Written by the indexing model from the issue text.